SELinux权限案例

系统更新后Nginx启动失败

journalctl -u nginx.service 中的日志为:

Starting The nginx HTTP and reverse proxy server...
nginx[2505]: nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx[2505]: nginx: [emerg] open() "/var/log/onlyoffice/documentserver/nginx.error.log" failed (13: Permission denied)
nginx[2505]: nginx: configuration file /etc/nginx/nginx.conf test failed
systemd[1]: nginx.service: Control process exited, code=exited status=1
systemd[1]: nginx.service: Failed with result 'exit-code'.
systemd[1]: Failed to start The nginx HTTP and reverse proxy server.

是由于 Nginx 没有足够的权限来访问日志文件 /var/log/onlyoffice/documentserver/nginx.error.log 导致的。

检查日志文件权限:ls -l /var/log/onlyoffice/documentserver/nginx.error.log 正常

检查SELinux 上下文:ls -Z /var/log/onlyoffice/documentserver/nginx.error.log

发现没有 httpd_log_t 类型标记

使用命令更正为正确的上下文:sudo restorecon -v /var/log/onlyoffice/documentserver/nginx.error.log

为能修正,尝试添加一个自定义的 SELinux 策略来允许 Nginx 访问日志文件

sudo semanage fcontext -a -t httpd_log_t "/var/log/onlyoffice(/.*)?"
sudo restorecon -R -v /var/log/onlyoffice

再次检查SELinux 上下文:ls -Z /var/log/onlyoffice/documentserver/nginx.error.log

已设置 httpd_log_t 类型标记

sudo systemctl restart nginx 成功重启Nginx服务